Since Motorola abandoned the [You must be registered and logged in to see this link.] a long time ago, the only way to enjoy an (almost) up-to-date Android experience is to install a custom ROM. In this post I’ll explain how to root your Milestone, backup your data, install CyanogenMod 7 and restore your data again.

First of all, the usual warnings:

This whole article only applies to the Motorola Milestone A853, the GSM version of the Verizon Droid. No other Milestone versions or other phones are supported!

If you don’t know what you’re doing, don’t do it.

If you mess up your phone (you cannot permanently brick a Milestone without a lot of knowledge and some serious bad faith, but you could easily lose all your data), don’t blame me or mr. muh, and don’t say I didn’t warn you.

If you think you made a mistake and you don’t know how to continue, then don’t! Connect your Milestone to the wall charger and ask somebody for help; you could, for instance, start up an IRC client, connect to the [You must be registered and logged in to see this link.] and join #milestone or #milestone-modding. I (pontomedon) am usually there, as well as there are a lot of people who know a lot more than i do.

A few general things about the Milestone:

Motorola signed our boot (contains the Linux kernel) and recovery (contains the recovery) partitions, so we cannot replace either of those with custom built images. CyanogenMod 7.1.2 for Milestone (the current version at the time of writing) runs Android 2.3.7 on the original Motorola boot partition (=kernel) from Android 2.2, which is possible because of a number of advanced hacks i cannot explain in detail here (partly because they’re outside of the scope of this article and partly because i don’t understand them myself).

In case of the recovery the situation is similar, we cannot replace the recovery partition by a custom recovery, but there is a workaround to get all the functionality of a custom recovery: Due to [You must be registered and logged in to see this link.] in the original Android 2.0 recovery code, it is possible to execute modified update.zip files, and it is also possible to create a special update.zip to extend the stock recovery with a lot of special features (this is exactly what OpenRecovery (OR) does, and it is also what the original root-exploit did). By the way, for those who are interested, the bug was [You must be registered and logged in to see this link.] after the Motorola Droid (the original, Verizon Wireless version of the Milestone) was rooted, but at that time the Milestone was already shipping with the bug on board.

From a not-rooted phone, the only way to replace the recovery partition with the vulnerable Android 2.0 recovery is to flash an SBF file. An SBF file is a proprietary Motorola format for mobile device images. Flashing an SBF file is done with RSDLite (a Windows only tool by Motorola) or sbf_flash, a Linux/Mac command line utility created by a member of the Droid/Milestone modding community, [mbm]. I’ll explain the process with both tools.

A quick overview on what we’ll be doing:

Install OR (consisting of an update.zip and a directory with a lot of scripts) on the SD card.

Install the recovery partition from Android 2.0, because this version contains the bug mentioned above.

Boot into OR

[Optional]: Prepare your SD card for Apps2Ext.

Backup your data.

Install CyanogenMod 7 for Milestone.

Restore your data.

[Optional, later]: Update your CyanogenMod to the latest version.

Before you continue: Make sure your battery is fully charged, you won’t be able to charge it while you’re booted into the bootloader or the recovery, and recovery eats A LOT of battery (it will be empty after two or three hours, so don’t take too much time to finish!).

Install OpenRecovery

If there is a file called update.zip on your SD card, please delete it to make sure you don’t accidentally install a wrong update.zip in step 3.

Download [You must be registered and logged in to see this link.] and unzip the contents of the ZIP archive to the root of your SD card. This download contains the original OpenRecovery v1.46, modified to include modules and libraries for SD card management (partitioning, support for ext2/3/4 file systems). Other modifications include fixes for the keyboard layout and baseband selectors. Most of the modifications were done by the creator of CyanogenMod4Milestone, nadlabak. For reference: the original, unmodified OR by Skrilax_CZ can be downloaded [You must be registered and logged in to see this link.], the original extension by nadlabak is found [You must be registered and logged in to see this link.]. The latest fixes included in my download are, however, not available anywhere else.

Update 2012-09-11: Nadlabak recompiled a few kernel modules, might fix some of the sd card errors during nandroid backup – they are now included in the download.

Update 2012-09-17: Please use the provided OR, it is the only way you get everything you need and the latest fixes. Many people seem to use different things like Androidiani or patching OR themselves etc and many of of those run into problems sooner or later. 50% of my effort in the comments below is wasted on of this.

You should now have a file called “update.zip” and a directory called “OpenRecovery” on your SD card.

</li>

Install the “vulnerable recovery”

There are two versions of this step, depending on your operating system. Windows users have to do part A, Linux and Mac users have to do part B.

Flashing with RSDLite (Windows)

Download the [You must be registered and logged in to see this link.] to a directory of your choice (on your computer).

Reboot your Milestone into bootloader mode by turning it off and holding the DPad-Up button while turning it on again. You should see some white-on-black text saying “Bootloader” now. It would be a good idea to write down your bootloader version now – it will be one of 80.89, 90.72, 90.73, 90.74 and 90.78.

Connect your Milestone to your computer and wait until Windows has successfully installed the driver.

Start RSDLite – the phone should be listed in the lower part of the window; model should be “S Flash OMAP3430″ and status should be “Connected…”. Click on that line, then the “Device Properties” section should be populated with information about your phone.

Open the SBF file by clicking the “…” button; the “File Properties” section should be populated now.

Very important: Read Step 3 to find out what your hotkey is and hold the hotkey all the time while RSDLite flashes. It is very important that you immediately boot into recovery after flashing it, if you boot into Android only once, chances are good that you’ll have to re-flash it.

Click the Start button and wait until the phone reboots. RSDLite will, after a while, complain that you should manually power the phone on, but you can safely close RSDLite as soon as your phone is booted into recovery (ignore any warnings when closing RSDLite).

</li>

Flashing with sbf_flash (Linux/Mac)

Download the [You must be registered and logged in to see this link.] to a directory of your choice (on your computer).

Download [You must be registered and logged in to see this link.] and save it in the same directory as the SBF file. You might also want to check [You must be registered and logged in to see this link.] for a new version of sbf_flash.

1

db8afd24f7a0dc6d3d78556dec811694 sbf_flash

Reboot your Milestone into bootloader mode by turning it off and holding the DPad-Up button while turning it on again. You should see some white-on-black text saying “Bootloader” now. It would be a good idea to write down your bootloader version now – it will be one of 80.89, 90.72, 90.73, 90.74 and 90.78.

Connect your Milestone to your computer.

Very important: Read Step 3 to find out what your hotkey is and hold the hotkey all the time while sbf_flash flashes. It is very important that you immediately boot into recovery after flashing it, if you boot into Android only once, chances are good that you’ll have to re-flash it.

Open a terminal emulator, cd to the directory with the SBF and type (as root)

Your phone should reboot (into recovery since you’re holding the hotkey) automatically after the flash is done.

</li>

</li>

Boot into OR

How you can boot into recovery depends on your bootloader version. For the bootloader version 90.78, the hotkey is x (the letter x on your hardware keyboard); for all other bootloader versions, the hotkey is the camera button. You need to press and hold the hotkey while you turn the phone on. Once you see the triangle with the exclamation mark in it, you can release the hotkey. Now press and hold the volume-up button and press the camera button to enter the actual recovery menu. If you see yellow text, you’ve done it right. What you see now is the stock recovery menu, to enter OR you have to select “apply sdcard:update.zip” (navigation is done with the DPad on the hardware keyboard, DPad-Center acts as enter). After a few seconds you should see a different menu, and the top line should say “Motorola MILESTONE Open Recovery”. If not, then something might have gone wrong in step 1. If yes, congratulations, you’ve successfully entered OR!

OR provides a more comfortable method of navigation, you can now use the volume buttons to navigate and the camera button to select. The first thing you should do is selecting the correct keyboard layout for your hardware keyboard:

Enter the “Settings/Keyboard Layout” menu and select the correct layout for your keyboard.

Now we come to the part why booting into recovery immediately after flashing was important: Motorolas OTA updates install a script called install-recovery.sh into your system partition, which overwrites the recovery with the stock (non-vulnerable) recovery on every single Android boot. We obviously don’t want this as we just flashed the vulnerable recovery, so we have to remove this file.

Select “Console” to enter the OR console

Type

1

rm -f /system/etc/install-recovery.sh

It might complain that the file doesn’t exist, which is possible if you never did an OTA update, but i’d double (and triple) check for typos…

You can type

1

exit

to exit the console

</li>

Backup and Root Phone

Be sure to have at least 1GB of free space on your SD card for this step (If you’ve done step 4 the free space on your FAT32 partition will have decreased by 1GB, but you still need about 1GB of free space for the backup!).

If you’re not in OR, reboot into OR as described in step 3.

Enter the “Nandroid/Backup” menu and select “Backup All”

OpenRecovery will now perform a nandroid backup, which is basically a full backup of your phone, including the Motorola firmware. If anything goes wrong you can always restore from this point. Nandroid backups are stored in a directory called “nandroid” on your SD card.

Once the Backup is finished, return to the main menu by selecting “Go Back” twice.

Root the phone by selecting “Root Phone”.

Reboot by selecting “Reboot System”.

We have now created an emergency backup, but we’ll now create a second, more user friendly backup using an extremely powerful app called[You must be registered and logged in to see this link.].

Download and install Titanium Backup from the Android Market and start it.

Upon start up, the Superuser app will ask if you allow root access of Titanium Backup, press allow and yes (you might have to restart Titanium Backup afterwards).

Change to the Backup/Restore tab, bring up the menu and select “Batch”.

After calculating the different scenarios has finished, click the Run button next to “Backup all user apps + system data”, then click “Run the Batch operation” (this will take a while).

I would also suggest to check whether your contacts are properly synced to Google: Open GMail, select “Contacts” from the drop down menu and check if all the contacts from your phone also appear there. If not, you might have stored some contacts to your phone memory instead of your Google account, I suggest to put them all on your Google account, they’re safer there. You can also use the chance to perform that long-overdue cleanup of your contacts .

Now you can safely wipe (aka Factory Restore) your phone.

</li>

Install CyanogenMod 7

Installing CyanogenMod is rather straight forward:

Download the latest version from [You must be registered and logged in to see this link.] and put it into the OpenRecovery/updates directory on your SD card.

You’ll also need the latest Google apps (Market, GMail etc); at the time of writing, the current version is [You must be registered and logged in to see this link.], but you might want to check [You must be registered and logged in to see this link.] if a newer version is available. Download the Google apps zip to the same directory you downloaded the cm7 update to.

If your current firmware is below 2.2, you need the following two update ZIP files as well: [You must be registered and logged in to see this link.], [You must be registered and logged in to see this link.]. Just like the other ZIP files, download them to the OpenRecovery/updates directory. If you’re unsure whether your bpsw and devtree are from 2.2 or not, just download those files, applying them twice is not harmful.

Reboot into OR as described in step 3.

Select “Wipe Dalvik Cache”.

Select “Wipe Data / Factory Reset” and confirm that you really want to clear all your data (we backed them up twice, so they’re safe).

By the way, you can ignore the three update files starting with “test-”, those are only interesting for developers. If they annoy you, you can delete them from the OpenRecovery/updates directory of your SD card.

Select the Google apps update ZIP file and confirm that you want to install it.

If you downloaded the BPSW Update and the Devtree Update, then apply those as well.

[optional] If you have enough free space on your SD card you might want to go back to the main menu and make another nandroid backup.

When you’re done, select reboot from OR’s main menu and enjoy your first boot of CyanogenMod 7 (The first boot takes longer than the following boots, so don’t panic if it takes a few minutes).

Once you’re booted into CyanogenMod, check if you have 3G connectivity, if not, you might have to select a different baseband configuration in Settings->Device Settings->Baseband selection. Changing the baseband configuration requires a reboot!

</li>

Restore

The first thing you have to do is install Titanium Backup from the Android Market again. When you start the app, it will (like before) ask for root privileges, press remember and allow (you might have to restart Titanium Backup afterwards).

Just like when you did the backup, enter the Backup/Restore tab, bring up the menu and press “Batch”.

Scroll down to the restore section and select “Restore missing apps with data” and confirm with “Run the batch operation”.

You should now have all your user apps back, but your system app settings are still missing. You could, of course, just restore them all with the according batch operation (“Restore all system data”), but i don’t recommend that, because most of the system settings contain the default values from the Motorola firmware, and you’re better off with the new default values from CyanogenMod. There are a few system apps you’ll want to restore though; and we’ll restore them one by one.

On the Backup/Recovery tab of Titanium Backup, click the label “Click to edit filters” in the top-right corner, select the “System” radio button in the second row of radio buttons and click “Apply” in the top-right corner.

For each system app you want to restore, click the app, select Restore from the pop-up menu and confirm that you want to restore “Data only”. Apps that you’ll want to restore are, for instance:

Bluetooth Pairings

[BOOKMARKS] Browser

[CONTACTS/CALLS] Contacts Storage

[VOICEMAIL] Dialer

[SMS/MMS/APN] Dialer Storage

[SMS/MMS PREFS] Messaging

[USER DICT] User Dictionary

Wi-Fi Access Points

If you’re not sure you absolutely need a specific system app to be restored, then don’t restore it, because if you miss anything in a week, you can still open Titanium Backup and restore it then.</li>

</li>

Update your CyanogenMod to the latest version

CyanogenMod is updated quite frequently, I suggest that you check the [You must be registered and logged in to see this link.] every few weeks, because you’ll have to install updates manually. It’s a really straight forward task:

Download the update ZIP file to your SD card, into the OpenRecovery/updates directory.

Reboot into OR (you can do this by selecting Reboot->Recovery from the power menu and you don’t even have to bother with the stock recovery anymore, CyanogenMod will reboot you directly into OR).

Wipe Cache Partition and Wipe Dalvik Cache (they contain only data that will be recreated during the next boot).